Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Meta Skill Weaver

v2.5.0

Use this skill when orchestrating complex multi-step tasks. Provides first-principles task decomposition, EventBus event system, multi-skill collaboration wi...

0· 266·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for pagoda111king/meta-skill-weaver.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Meta Skill Weaver" (pagoda111king/meta-skill-weaver) from ClawHub.
Skill page: https://clawhub.ai/pagoda111king/meta-skill-weaver
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install meta-skill-weaver

ClawHub CLI

Package manager switcher

npx clawhub@latest install meta-skill-weaver
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description claim an orchestration/meta-skill (task decomposition, EventBus, middleware, metrics, feedback). The bundled files (middleware implementations, tests, coverage, package.json/lock) are consistent with that purpose. However, the package includes source and a package-lock but the skill registry entry declares no install spec; SKILL.md also references a 'clawhub install' CLI command — this mismatch (packaged source but no declared install mechanism) is unexpected and should be clarified. There are also inconsistent maintainer/contact strings across files (pagoda111king, cloud-shrimp, '王的奴隶'), and differing version numbers in headers, which reduce confidence in provenance.
!
Instruction Scope
SKILL.md instructs the agent to run CLI commands (meta-skill-weaver start/status/resume/cancel) and to register event handlers (e.g., meta-skill-weaver on 'task.complete' --handler="notify.sh"). Allowing arbitrary shell handlers (notify.sh) and Exec/Bash tools (declared in SKILL.md) means runtime can execute arbitrary scripts on the host when used. The documentation discusses persisting metrics/feedback and 'virtual path' storage but does not specify storage locations or whether network endpoints are contacted; that ambiguity could allow data exfiltration if middleware is configured to send metrics or feedback off-host. The instructions do not read unrelated system files or request credentials explicitly, but their open-ended handler execution and unspecified persistence endpoints increase risk.
Install Mechanism
No install spec is declared in the registry (instruction-only), but the bundle contains package.json and a large package-lock, source JS files, and coverage artifacts — implying an npm project that expects to be installed. That mismatch is notable: a consumer following SKILL.md's 'clawhub install meta-skill-weaver' may download/execute code not described by the registry entry. Lack of an explicit, reviewable install mechanism increases friction for safe vetting (you can't tell from metadata which packages would be installed).
Credentials
The registry declares no required environment variables or credentials, which is consistent with SKILL.md. At the same time, SKILL.md mentions built-in middleware including 'Auth' and persistent metrics/feedback storage, which plausibly require external credentials or storage config — none are declared. This absence of declared env/config requirements while describing features that typically need storage/auth is an information gap that should be resolved before trusting the skill with sensitive data.
Persistence & Privilege
The skill does not request forced persistence (always:false) and uses normal autonomous invocation settings (disable-model-invocation:false), which is expected. It documents saving task state to a 'virtual path' and persisting metrics/feedback, but does not state where those artifacts live (local filesystem, external DB, cloud). Because the skill can persist state and execute shell handlers, confirm storage locations and access controls; though not an outright privilege escalation, the combination of persisted state + arbitrary handler execution increases the blast radius if the code were malicious or misconfigured.
What to consider before installing
This skill appears to implement the orchestration features it advertises, but there are several unexplained inconsistencies and some runtime vectors that need clarification before installation. Before you install or enable it broadly: 1) Ask the maintainer for the canonical source repository and a signed/consistent release (the metadata/contacts/versions in the package are inconsistent). 2) Request a clear install spec (what the installer does, exact npm dependencies from package.json) and run npm audit on the package-lock in a sandbox. 3) Confirm where metrics/feedback and 'virtual path' state are persisted (local sandboxed storage vs remote endpoints) and whether any network endpoints are contacted; get explicit env vars required for remote storage if any. 4) Verify what arbitrary handlers (e.g., notify.sh) are allowed to run and ensure they cannot be supplied by untrusted users; avoid enabling arbitrary shell execution handlers in production. 5) If you must test it, run it in an isolated sandbox/container with no access to production secrets, and review src/middleware/*.js for any outbound network calls or uses of child_process/exec. If the maintainer cannot answer these questions or provide a single authoritative repository and release notes, treat the package as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk974b4xns13vq52czwmg9gq3a185nthx
266downloads
0stars
8versions
Updated 1d ago
v2.5.0
MIT-0

Meta Skill Weaver - 技能编织器

版本:v2.4.0
定位:L2 编排层 - 多技能协作编排引擎
状态:✅ 生产就绪(54 个新增测试用例,MetricsMiddleware + FeedbackMiddleware)


📖 技能说明

Meta Skill Weaver 是一款企业级 AI 技能编排引擎,专为复杂多步骤任务设计。它通过第一性原理任务分解器将宏大目标拆解为原子任务,利用 EventBus 事件系统实现多技能松耦合协作,支持并行执行、超时控制、中断恢复。v2.3 新增 35 个 Jest 测试用例(覆盖率 62%),确保生产级稳定性。

核心价值:让 AI 从"单点响应"升级为"系统协作",轻松驾驭研究→分析→报告等长程任务,是构建企业级 AI 工作流的必备基础设施。

适用场景

  • ✅ 多步骤研究报告(资料收集→数据分析→报告撰写)
  • ✅ 跨技能协作任务(同时调用 3+ 技能)
  • ✅ 长时中断恢复(支持 15 分钟超时控制)
  • ✅ 事件驱动工作流(基于 EventBus 订阅/发布)
  • ✅ 企业级任务编排(7 个内置中间件)

🎯 使用场景

场景 1:多步骤研究报告

任务:「研究 AI Agent 市场趋势,生成分析报告」

编排流程

1. 资料收集(web_search, browser)
   ↓
2. 数据分析(xlsx, data-analysis)
   ↓
3. 报告撰写(copywriting, docx)
   ↓
4. 质量审查(quality-checker)
   ↓
5. 发布报告(publish)

使用方式

meta-skill-weaver start \
  --task="研究 AI Agent 市场趋势" \
  --skills="web_search,browser,xlsx,copywriting,docx" \
  --timeout=15m \
  --parallel=true

预期结果

  • 自动分解为 5 个子任务
  • 并行执行可并行的任务
  • 自动追踪每个子任务进度
  • 支持中断后从断点恢复

场景 2:跨技能协作任务

任务:「分析销售数据,生成 PPT 报告」

编排流程

1. 读取 Excel 数据(xlsx)
   ↓
2. 数据分析(data-analysis)
   ↓
3. 生成图表(chart-generator)
   ↓
4. 创建 PPT(pptx)
   ↓
5. 导出 PDF(pdf)

使用方式

meta-skill-weaver start \
  --task="分析销售数据生成 PPT" \
  --skills="xlsx,data-analysis,chart-generator,pptx,pdf" \
  --output="sales-report.pdf"

场景 3:长时中断恢复

任务:「完成市场研究报告(可能需要 2 小时)」

中断恢复流程

1. 启动任务(15 分钟超时)
   ↓
2. 任务中断(用户暂停/超时)
   ↓
3. 自动保存状态到虚拟路径
   ↓
4. 用户恢复:meta-skill-weaver resume <task-id>
   ↓
5. 从断点继续,已完成子任务不重复执行

💰 定价方案

版本价格功能适用对象
个人版¥99/年基础任务编排、3 技能并发、中断恢复、虚拟路径隔离个人开发者、研究者
商业版¥999/年个人版 + EventBus 事件系统、7 中间件、35 单元测试、优先支持小型团队、创业公司
企业版¥9999/年商业版 + 自定义中间件、私有部署、SLA 保障、专属技术支持中大型企业、系统集成商

❓ FAQ(常见问题)

Q1: Meta Skill Weaver 适合什么类型的任务?
A: 适合需要 3+ 步骤、调用多个技能、耗时超过 5 分钟的复杂任务。简单查询类任务无需使用。

Q2: 任务中断后如何恢复?
A: 系统自动保存任务状态到虚拟路径,调用resume-task命令即可从断点继续,已完成的子任务不会重复执行。

Q3: EventBus 事件系统如何使用?
A: 通过bus.on('事件名', 回调)订阅事件,bus.emit('事件名', 数据)发布事件。支持事件拦截器和上下文保持。

Q4: 如何监控任务执行进度?
A: 调用get-task-status命令返回 6 种状态(pending/running/paused/completed/failed/cancelled)及每个子任务的详细进度。

Q5: 支持多少并发任务?
A: 默认限制 3 个并发任务,企业版可自定义并发数。超过限制的任务会进入队列等待。

Q6: 虚拟路径隔离如何工作?
A: 每个任务创建独立的虚拟路径空间,任务间数据完全隔离,避免数据污染和冲突。

Q7: 如何自定义中间件?
A: 企业版支持自定义中间件,继承Middleware基类,实现execute(context, next)方法即可。


🚀 快速开始

安装

clawhub install meta-skill-weaver

基础使用

# 启动任务
meta-skill-weaver start --task="任务描述" --skills="skill1,skill2,skill3"

# 查看状态
meta-skill-weaver status <task-id>

# 恢复任务
meta-skill-weaver resume <task-id>

# 取消任务
meta-skill-weaver cancel <task-id>

高级使用

# 并行执行
meta-skill-weaver start \
  --task="并行任务" \
  --skills="skill1,skill2,skill3" \
  --parallel=true

# 超时控制
meta-skill-weaver start \
  --task="长时任务" \
  --timeout=30m

# 事件监听
meta-skill-weaver on 'task.complete' \
  --handler="notify.sh"

📊 技术架构

核心组件

┌─────────────────────────────────────────┐
│           Task Decomposer               │
│  (第一性原理任务分解器)                   │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│           EventBus                      │
│  (事件系统 - 订阅/发布)                   │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│        Middleware Chain                 │
│  (7 个内置中间件)                         │
│  - Logging, Auth, RateLimit, Cache...   │
└─────────────────┬───────────────────────┘
                  │
┌─────────────────▼───────────────────────┐
│        Virtual Path System              │
│  (虚拟路径隔离)                           │
└─────────────────────────────────────────┘

测试覆盖

模块覆盖率测试用例数
Task Decomposer75%12
EventBus80%10
Middleware Chain60%8
Virtual Path55%5
总计62%35

📁 文件结构

meta-skill-weaver/
├── SKILL.md              # 技能定义(本文件)
├── README.md             # 详细文档
├── package.json          # 依赖配置
├── src/
│   ├── index.js          # 主入口
│   ├── decomposer.js     # 任务分解器
│   ├── event-bus.js      # 事件系统
│   ├── middleware/       # 中间件
│   └── virtual-path.js   # 虚拟路径
├── tests/
│   ├── decomposer.test.js
│   ├── event-bus.test.js
│   ├── middleware.test.js
│   └── virtual-path.test.js
└── examples/
    ├── basic-usage.js
    ├── advanced-usage.js
    └── enterprise-usage.js

🏆 成功案例

案例 1:AI 市场研究报告

客户:某 AI 创业公司
任务:研究 AI Agent 市场趋势,生成 50 页报告
技能调用:web_search, browser, xlsx, data-analysis, copywriting, docx
执行时间:45 分钟
结果:自动生成 50 页报告,节省 8 小时人工时间

案例 2:销售数据分析

客户:某电商公司
任务:分析 Q4 销售数据,生成 PPT 报告
技能调用:xlsx, data-analysis, chart-generator, pptx, pdf
执行时间:30 分钟
结果:自动生成 PPT,数据准确率 100%


📞 技术支持


📜 许可证

MIT License - 免费使用、修改和重新分发


文件版本:v2.3.0
创建时间:2026-04-01
上架时间:2026-04-01
更新时间:2026-04-02
上架用户:pagoda111king
测试状态:✅ 35 个测试用例,62% 覆盖率

Comments

Loading comments...